mirror of
https://github.com/kittywitch/nixfiles.git
synced 2026-02-09 04:19:19 -08:00
style: alejandra, deadnix, statix
This commit is contained in:
parent
2e7ee0e4ca
commit
17c69c99de
GPG key ID:
465E64DECEA8CF0F
78 changed files with 1051 additions and 878 deletions
|
|
@ -13,9 +13,11 @@
|
|||
config.users.users);
|
||||
};
|
||||
in {
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
security.sudo.enable = true;
|
||||
security.pam.services.sudo.sshAgentAuth = true;
|
||||
security = {
|
||||
pam.sshAgentAuth.enable = true;
|
||||
sudo.enable = true;
|
||||
pam.services.sudo.sshAgentAuth = true;
|
||||
};
|
||||
users.users = {
|
||||
root = commonUser;
|
||||
deploy =
|
||||
|
|
|
|||
|
|
@ -1,32 +1,38 @@
|
|||
{ pkgs, lib, config, ... }: let
|
||||
inherit (lib.modules) mkAfter mkDefault;
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
inherit (lib.modules) mkAfter mkDefault;
|
||||
in {
|
||||
sops.secrets.sshd-environment = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
security.pam.services.sshd.text = let
|
||||
sops.secrets.sshd-environment = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
security.pam.services.sshd.text = let
|
||||
notify = pkgs.writeShellScriptBin "notify" ''
|
||||
export $(cat ${config.sops.secrets.sshd-environment.path} | xargs)
|
||||
export $(cat ${config.sops.secrets.sshd-environment.path} | xargs)
|
||||
|
||||
if [ "$PAM_USER" = "deploy" ]; then
|
||||
if [ "$PAM_TYPE" = "open_session" ]; then
|
||||
message="''${PAM_RHOST} has opened an SSH session as part of doing a Nix deployment on ${config.networking.hostName}."
|
||||
elif [ "$PAM_TYPE" = "close_session" ]; then
|
||||
message="''${PAM_RHOST} has closed an SSH session as part of doing a Nix deployment on ${config.networking.hostName}."
|
||||
fi
|
||||
else
|
||||
if [ "$PAM_TYPE" = "open_session" ]; then
|
||||
message="''${PAM_RHOST} opened an SSH session with ${config.networking.hostName} as user ''${PAM_USER}."
|
||||
elif [ "$PAM_TYPE" = "close_session" ]; then
|
||||
message="''${PAM_RHOST} closed their SSH session with ${config.networking.hostName} for user ''${PAM_USER}."
|
||||
fi
|
||||
fi
|
||||
if [ "$PAM_USER" = "deploy" ]; then
|
||||
if [ "$PAM_TYPE" = "open_session" ]; then
|
||||
message="''${PAM_RHOST} has opened an SSH session as part of doing a Nix deployment on ${config.networking.hostName}."
|
||||
elif [ "$PAM_TYPE" = "close_session" ]; then
|
||||
message="''${PAM_RHOST} has closed an SSH session as part of doing a Nix deployment on ${config.networking.hostName}."
|
||||
fi
|
||||
else
|
||||
if [ "$PAM_TYPE" = "open_session" ]; then
|
||||
message="''${PAM_RHOST} opened an SSH session with ${config.networking.hostName} as user ''${PAM_USER}."
|
||||
elif [ "$PAM_TYPE" = "close_session" ]; then
|
||||
message="''${PAM_RHOST} closed their SSH session with ${config.networking.hostName} for user ''${PAM_USER}."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$message" ]; then
|
||||
${pkgs.curl}/bin/curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": \"$message\"}" $DISCORD_WEBHOOK_LINK
|
||||
fi
|
||||
if [ -n "$message" ]; then
|
||||
${pkgs.curl}/bin/curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": \"$message\"}" $DISCORD_WEBHOOK_LINK
|
||||
fi
|
||||
'';
|
||||
in mkDefault (mkAfter ''
|
||||
session required pam_exec.so seteuid ${notify}/bin/notify
|
||||
'');
|
||||
}
|
||||
in
|
||||
mkDefault (mkAfter ''
|
||||
session required pam_exec.so seteuid ${notify}/bin/notify
|
||||
'');
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
sshd-environment: ENC[AES256_GCM,data:lyzzRDxyNzBgrLthPjdJoXgkniCwLXFZE/GMpLlRzeSvAUN6yc8sFYTmvZiCe/t/33Yr5+BtOhAUI5JzTYJ/kc3Dg4ziB4KbHP4ejPtAb6x2UbEHcN6euPogwXR8lpeO9zJE4gWFOHoYJ4bLa1wuCYgbNkjWDYYHGEoWAMVDU6XYRb3riV21WWIQO/DbC7mAgw==,iv:ZysLG3x0wlxuTYnJrGtrTkjjduMoEOyiWWuC1nRIp4I=,tag:mlNO2yo7JkV2O7A2Da+EjQ==,type:str]
|
||||
tailscale-key: ENC[AES256_GCM,data:FK237Or4qtZGon9tevPh4q568+IUSWxfuG8s2ZNLXWgoa76GoyO+qwCmvXiVibRH1Ljo/LXoNQjb2pYV7w==,iv:UZv+EnlRDOWh86sOFh7ZNryPz1r55u+Dbr/dDL/USjo=,tag:B8DJwPXR/50ARbfyfxPtcw==,type:str]
|
||||
sops:
|
||||
shamir_threshold: 1
|
||||
kms: []
|
||||
|
|
@ -69,8 +70,8 @@ sops:
|
|||
N0hTL1A1MVE2MldocTFWZzc1OENobkUKUseg2IGSClvmrq6vlnF1sCgYlUaH4Ke0
|
||||
sDdpVwg1b5WLwbZFeE/Ro1gRY3s+9iDFrU3Rh95R1KmigpMVYz1ILQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-07-04T21:22:16Z"
|
||||
mac: ENC[AES256_GCM,data:5obbMHWEPm7KhJGWXpsKvGI99sJCx8hScIbS2vo3Ua0fvTwML8tkC3gsfLwaZ0D3KGHN6qxyjvP8ajIoxRK2Lj6G2FOWo7gmNzw9ULu+kPj53dqbmy/c3EeZU3WFNaRFXiQx0C80k8YFzPXQAkF/X5NdaRYRL6BFvPRRuq83Uds=,iv:EaeI+Z3e/QZIlU+EIGg+9sDFPtcfnVs8TQvvROOujg4=,tag:+P6U0/+b4nkZNob5fJ6pkg==,type:str]
|
||||
lastmodified: "2024-08-03T22:14:00Z"
|
||||
mac: ENC[AES256_GCM,data:ACZ3txmEBIUU73JSsJmDDE7+D5oXdAVNN1Dgypl8tgRIGtMFwRpktmhdXON6jHpaWiZ0DBRuvN97SWUbkPbhyMG6PrKRdQHYLdFAocuNFBpX58xIrAclVUjPEbV5bqBU/zPemxj/5sXbiuX8AYSENiAOYhfCxi8SZbNgU4W6xO8=,iv:G2d9ZRTeaNpDfkB3maZzAHYIRKB6ewwjqUQr7RBrNEM=,tag:7y/0gVUJMmyMoiwiLr8Q1g==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-07-04T21:21:19Z"
|
||||
enc: |-
|
||||
|
|
@ -93,4 +94,4 @@ sops:
|
|||
-----END PGP MESSAGE-----
|
||||
fp: CD8CE78CB0B3BDD4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
version: 3.9.0
|
||||
|
|
|
|||
|
|
@ -1,3 +1,77 @@
|
|||
_: {
|
||||
services.tailscale.enable = true;
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.services.tailscale;
|
||||
in {
|
||||
options.services.tailscale = with types; {
|
||||
advertiseExitNode = mkEnableOption "exit node";
|
||||
};
|
||||
config = {
|
||||
networking.firewall = {
|
||||
trustedInterfaces = [cfg.interfaceName];
|
||||
allowedUDPPorts = [cfg.port];
|
||||
};
|
||||
systemd.network = {
|
||||
wait-online.ignoredInterfaces = [cfg.interfaceName];
|
||||
networks."50-tailscale" = {
|
||||
networkConfig = {
|
||||
DNSDefaultRoute = false;
|
||||
#DNS = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.tailscale.enable = mkDefault true;
|
||||
|
||||
sops.secrets.tailscale-key = mkIf cfg.enable {
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
systemd.services.tailscale-autoconnect = mkIf cfg.enable rec {
|
||||
description = "Automatic connection to Tailscale";
|
||||
|
||||
# make sure tailscale is running before trying to connect to tailscale
|
||||
after = wants ++ wantedBy;
|
||||
wants = ["network-pre.target"];
|
||||
wantedBy = ["tailscaled.service"];
|
||||
|
||||
# set this service as a oneshot job
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
};
|
||||
|
||||
# have the job run this shell script
|
||||
script = let
|
||||
fixResolved = optionalString config.services.resolved.enable ''
|
||||
resolvectl revert ${cfg.interfaceName} || true
|
||||
'';
|
||||
# https://tailscale.com/kb/1320/performance-best-practices#ethtool-configuration
|
||||
exitNodeRouting = optionalString cfg.advertiseExitNode ''
|
||||
netdev=$(${pkgs.iproute2}/bin/ip route show 0/0 | ${pkgs.coreutils}/bin/cut -f5 -d' ' || echo ${config.systemd.network.networks._00-local.name or "eth0"})
|
||||
${getExe pkgs.ethtool} -K "$netdev" rx-udp-gro-forwarding on rx-gro-list off || true
|
||||
'';
|
||||
advertiseExitNode = "--advertise-exit-node" + optionalString (!cfg.advertiseExitNode) "=false";
|
||||
in
|
||||
with pkgs; ''
|
||||
# wait for tailscaled to settle
|
||||
sleep 5
|
||||
|
||||
${fixResolved}
|
||||
${exitNodeRouting}
|
||||
|
||||
# check if we are already authenticated to tailscale
|
||||
status="$(${getExe tailscale} status -json | ${getExe jq} -r .BackendState)"
|
||||
if [[ $status = Running ]]; then
|
||||
# if so, then do nothing
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# otherwise authenticate with tailscale
|
||||
${getExe tailscale} up ${advertiseExitNode} -authkey $(cat ${config.sops.secrets.tailscale-key.path})
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue